AD: Only connect to GC for subdomain users
    
    https://fedorahosted.org/sssd/ticket/2251
    
    By connecting to GC for users from both trusted domains and parent
    domain, we lose the ability to download the shell and homedir if these
    are used with ID mapping.
    
    This patch changes the user lookups only. Changing the logic for all
    lookups would break cross-domain group memberships, for example.
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>